diff --git a/.github/workflows/tooling-ci.yml b/.github/workflows/tooling-ci.yml
index 6dd803f..14dcf42 100644
--- a/.github/workflows/tooling-ci.yml
+++ b/.github/workflows/tooling-ci.yml
@@ -135,7 +135,6 @@ jobs:
           )
 
           actionlint_args=(
-            -shellcheck=
             -pyflakes=
             -ignore 'missing input "app-id" which is required by action "actions/create-github-app-token@v3"'
             -ignore 'input "client-id" is not defined in action "actions/create-github-app-token@v3"'
@@ -174,12 +173,12 @@ jobs:
             echo "| Check | Result | Artifact |"
             echo "| --- | --- | --- |"
             if [[ "$status" -eq 0 ]]; then
-              echo "| Core workflow semantics | pass | tooling-ci-actionlint-json: artifacts/actionlint/actionlint.json |"
+              echo "| Workflow semantics and ShellCheck | pass | tooling-ci-actionlint-json: artifacts/actionlint/actionlint.json |"
             else
-              echo "| Core workflow semantics | fail | tooling-ci-actionlint-json: artifacts/actionlint/actionlint.json |"
+              echo "| Workflow semantics and ShellCheck | fail | tooling-ci-actionlint-json: artifacts/actionlint/actionlint.json |"
             fi
             echo
-            echo "ShellCheck and pyflakes integrations are disabled for the first rollout; the current blocking check is core actionlint semantics."
+            echo "ShellCheck is blocking; the pyflakes integration stays disabled."
           } >> "$GITHUB_STEP_SUMMARY"
 
           exit "$status"
diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml
index 39b9cdf..4d94aa0 100644
--- a/.github/workflows/validation.yml
+++ b/.github/workflows/validation.yml
@@ -545,6 +545,7 @@ jobs:
             name=$(basename "$spec")
             # Skip specs with no external $ref — bundling would only
             # normalize formatting, producing a misleading diff artifact.
+            # shellcheck disable=SC2016  # \$ref is a regex, not an expansion
             if ! grep -qE '\$ref:\s*["'"'"'][^#]' "$spec"; then
               echo "Skipped (no external \$ref): $name"
               continue
@@ -585,8 +586,10 @@ jobs:
       - name: Report orchestrator failure
         if: always() && steps.validation.outcome == 'failure'
         run: |
-          echo "## CAMARA Validation" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "**Error**: The validation orchestrator failed with an infrastructure error." >> "$GITHUB_STEP_SUMMARY"
-          echo "Check the workflow logs for details." >> "$GITHUB_STEP_SUMMARY"
+          {
+            echo "## CAMARA Validation"
+            echo ""
+            echo "**Error**: The validation orchestrator failed with an infrastructure error."
+            echo "Check the workflow logs for details."
+          } >> "$GITHUB_STEP_SUMMARY"
           exit 1